Detecting non-local violations of API contracts in large software systems

 

Eric Bodden (McGill University, CA)

 

Abstract:

Many defects in modern software systems arise because programmers use
application interfaces (APIs) incorrectly. APIs often impose implicit
usage contracts on their clients and clients can violate these
contracts in very subtle ways, through long call chains and through
aliased objects. Such violations are hard to find and a generic
approach to identify such violations is required.

We show how subtle API contract violations can be detected using a
hybrid analysis approach that combines static and dynamic
whole-program analyses. Our verification system takes a given program
and a contract for APIs used by this program as input. The
verification system then first identifies potential points of failure
in the program and applies a battery of four static analyses to rule
out possible violations at those points, at compile time. In cases
where the verification system reports potential contract violations,
the programmer can choose to either inspect those potential violations
manually, or to have monitoring code inserted that will report actual
violations at runtime. The proposed static analyses specialize the
monitoring code, making it very efficient.

Our results show that the combined analysis is effective and scalable
enough to identify the sources of many contract violations in large
software systems.